net/mac80211/tests/ttlm.c

Source file repositories/reference/linux-study-clean/net/mac80211/tests/ttlm.c

File Facts

System
Linux kernel
Corpus path
net/mac80211/tests/ttlm.c
Extension
.c
Size
5697 bytes
Lines
176
Domain
Networking Core
Bucket
Sockets, Protocols, Packet Path, And Network Policy
Inferred role
Networking Core: implementation source
Status
source implementation candidate

Why This File Exists

Networking stack implementation surface: socket APIs, protocol dispatch, packet flow, routing, filtering, and network namespaces.

Dependency Surface

Detected Declarations

Annotated Snippet

// SPDX-License-Identifier: GPL-2.0-only
/*
 * KUnit tests for negotiated TTLM (TID-To-Link Mapping) parsing
 *
 * Copyright (C) 2026 Michael Bommarito <michael.bommarito@gmail.com>
 */
#include <kunit/test.h>
#include <linux/ieee80211.h>
#include "../ieee80211_i.h"

MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");

/*
 * Build a negotiated TTLM element in caller-supplied buffer.
 *
 * @buf:       destination buffer (must be at least elem_size bytes)
 * @elem_size: sizeof(ttlm_elem) + 1 (presence byte) + npresent * bm_size
 * @presence:  link_map_presence bitmask; each set bit => one map follows
 * @bm_size:   bytes per map (1 or 2); 2 => LINK_MAP_SIZE bit clear
 * @maps:      array of npresent u16 maps, one per set bit in presence
 *
 * Control field encodes direction=BOTH; no switch-time, no expected-dur,
 * no DEF_LINK_MAP.  LINK_MAP_SIZE bit is set iff bm_size==1.
 *
 * Returns pointer to the ieee80211_ttlm_elem at buf.
 */
static const struct ieee80211_ttlm_elem *
build_neg_ttlm_elem(u8 *buf, size_t elem_size,
		    u8 presence, u8 bm_size, const u16 *maps)
{
	struct ieee80211_ttlm_elem *t = (void *)buf;
	u8 control;
	u8 *pos;
	int i, tid;

	memset(buf, 0, elem_size);

	control = IEEE80211_TTLM_DIRECTION_BOTH; /* bits [1:0] = 2 */
	if (bm_size == 1)
		control |= IEEE80211_TTLM_CONTROL_LINK_MAP_SIZE;

	t->control = control;

	pos = (u8 *)t->optional;
	*pos++ = presence;

	i = 0;
	for (tid = 0; tid < IEEE80211_TTLM_NUM_TIDS; tid++) {
		if (!(presence & BIT(tid)))
			continue;
		if (bm_size == 1)
			*pos = (u8)maps[i];
		else
			put_unaligned_le16(maps[i], pos);
		pos += bm_size;
		i++;
	}

	return t;
}

/*
 * sparse_presence_no_oob_read - BIT(0)|BIT(7) presence, bm_size=2
 *
 * Only TID 0 and TID 7 have maps; TIDs 1-6 are absent.  Element length
 * is exactly 6 bytes (1 control + 1 presence + 2 * 2-byte maps).
 *
 * Pre-fix the parser advanced pos by bm_size AFTER the switch() block
 * (i.e. unconditionally for every TID), so when processing TID 7 it
 * had already advanced 6 * bm_size = 12 bytes past the presence byte
 * for the absent TIDs before reading the TID-7 map - 14 bytes past the
 * end of the 2-byte TID-7 map.  Under KASAN that is a slab-out-of-bounds.
 *
 * After the fix pos is advanced only inside the presence-bit branch so
 * the cursor lands exactly at end-of-element after processing TID 7.
 */
static void sparse_presence_no_oob_read(struct kunit *test)
{
	/*
	 * presence = BIT(0)|BIT(7): 2 maps present.
	 * elem_size = sizeof(ttlm_elem) + 1 (presence) + 2*2 (maps) = 6.
	 */
	const u8 presence = BIT(0) | BIT(7);
	const u8 bm_size = 2;
	const int npresent = 2;
	const size_t elem_size = sizeof(struct ieee80211_ttlm_elem)
				 + 1 + npresent * bm_size;
	/*
	 * Allocate exact-size buffer so a pre-fix OOB read walks into the
	 * KASAN red zone immediately after the allocation.

Annotation

Implementation Notes